1. Field of the Invention
The invention relates to electronic purse systems, and in particular it relates to the improved management of multiple money flows in such systems.
2. Description of the Related Art
Electronic purse systems exist in multiple implementations and are usually targeted at one particular group of customers.
An example is the electronic purse system operated by the German Zentraler Kreditausschuss (ZKA) which handles the management of eurocheque cards, so-called ec-cards, issued for actuating electronic money transfers intended by the owners of ec-cards, the respective card holders in Germany.
The implementations which are known can, however, usually accommodate only one currency at a time, or they can only accept payments from one user group and do not have the capability to differentiate between more than one user group when using only one system key. Examples for such a desired differentiation are, however, patrons as service buyers at a company cafeteria which is open to employees of the company but also to contractors, to employees of a neighbor establishment, visitors from other companies, or other eligible groups.
It is important that, when the card holder comes to a service provider and makes a purchase, the service provider is reimbursed for his services from the money which the card holder has paid when he had loaded his electronic purse. The path this money takes through the system is a money flow.
Purses known so far do not have the feature to support more than one money flow with one system key only. They are understood to work with one currency and for one user group only.
For terminology purposes, “purse” described here is understood to be a money management component which is configured to work with one currency at a time. The surrounding system however can accept a multitude of such “purses” configured to different currencies.
If card holders can load their purses in one place and spend it in another place, or if there are different card holder groups, then the necessity can arise that these money flows shall be kept separate. The purse provider is the hub who receives load transaction records and money from the load stations, keeps these money flows in a multitude of accounts, and distributes the money from these accounts to service providers upon receipt of a purchase transaction record. If there is more than one environment—where the term “environment” should be understood for the purposes of the present invention as a synonym for user group—in which cards can be loaded, and/or more than one environment in which the money can be spent for purchases, then the purse provider has to keep as many accounts as there are environments or user groups, respectively. Each such an account in prior art technique is associated with the task of maintaining a system key.
Money flows into an account or out from an account must be traceable to the respective environment in which the load and purchase transactions have taken place. The purse system provider therefore has a business interest to keep these money flows separate and track them separately mainly because of billing purposes associated with the concerned service provider(s).
The service providers themselves may also want to differentiate between different groups of buyers simply for identification purposes. Different prices based on a certain subsidy for the employees which is not granted to foreign persons may for instance be a reason to identify user groups separately. Other reasons exist dependent of the respective field of application.
User group separation can also be accomplished—and has been in the past—with different system keys for each group. Such a differentiation by keys introduces a prohibitively involved key management, including a corresponding number of secure access modules (SAMs), which are installed in each load and pay stations in order to perform a secure processing of any load and purchase transaction and which thus have to be present in any load stations and purchase stations contained in the system.
The handling of more than one system key, however, is difficult as each system key has to be kept strictly secret and must be hidden from service persons occupied with servicing the transaction processes and the services necessary to operate the plurality of SAMs. In any case, the generation and the distribution of such a system key has to be kept secure. Thus, even checking if a system key stored in a SAM is correct is a task which is difficult to perform, as it is not readable there out of reasons of security. The more different system keys a purse system uses, the lesser comfortable is its management.